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Abstract 

Under rather general assumptions about the properties of a noisy quantum channel, a first quan- 
tum protocol is proposed which allows to implement the secret bit commitment with the probability 
arbitrarily close to unity. 

g ; PACS numbers: 89.70,+c, 03.65.-w 

The idea that quantum physics can provide more secure communication between two distant parties 

■ than the classical one was first put forward by Wiesner [1]. Later, after the works [2,3], a lot of papers 
Ch , devoted to secret key distribution (quantum cryptography) have been published. Apart from the key 

^ | distribution protocol, there exist other cryptographic protocols which are both important for applications 

■ and interesting in themselves. These are the so-called Bit Commitment (BC) and Coin Tossing (CT) 
CN ■ protocols [4,5]. Quantum versions of these protocols were first proposed by Bennett and Brassard [6]. 

BC is the information exchange protocol allowing two distant users A and B which do not trust each 
' other to implement the following scheme. User A sends some (part of) information on his secret bit b 

■ (b = or 1, commitment stage) to user B in such a way that user B cannot recover the secret bit chosen 
by A on the basis of information supplied alone. However, this information should be sufficient to prevent 
cheating by user A, i.e., later (at the disclosure stage) when user B asks user A to send him the rest 
information on the chosen secret bit, user A should be unable to change his mind and modify the value 
of his secret bit. The CT protocol is the scheme allowing two distant users which do not trust each other 

^ | to implement the procedure of drawing an honest lot. 

Classical versions of these protocols are based on unproved computational complexity of some trap- 
door functions which require exponentially large resources to calculate their inverse on the classical 
Jh I computer [7,8]. 

Some time ago it was generally assumed that the quantum protocols based on the fundamental 
Q H . restriction imposed by the laws of quantum mechanics rather than on the computational complexity are 
unconditionally secure [9]. However, it was later shown by Mayers, Lo and Chau [10,11] that the non- 
relativistic quantum BC protocol is not actually secure. User A can cheat user B without being detected 
by the latter employing the so-called EPR-attack (EPR stands for Einstein, Podolsky, and Rosen [12]). 
?3 \ The possibility of successful EPR-attack is actually based on the result of paper by Hougston, Josza, and 
Wotters on the measurements performed over the quantum ensembles of composite systems [13]. 

All the above mentioned non-relativistic quantum protocols are only based on the properties of the 
quantum states in the Hilbert space and do not explicitly contain the effects of state propagation between 
the two distant users. However, actually the information transfer occurs in the Minkowski space-time. 
Explicit accounting for this circumstance extends the possibilities for development of new relativistic 
quantum protocols [14] and substantially simplifies the proof of their security [15]. Restrictions imposed 
by the special relativity on the measurements performed on quantum states allow to realize the secure BC 
and CT protocols in the ideal channel [16]. Failure of the EPR-attack in the relativistic case is related 
to the impossibility of an instant modification of an extended quantum state. In addition, it is even 
impossible to instantly and reliably distinguish between two orthogonal states. Restrictions imposed by 
the special relativity on the measurement of quantum states were first discussed by Landau and Peierls 
[17]. 

In the present paper we propose the first relativistic BC protocol in a quantum noisy channel. Intu- 
itively, the idea behind the protocol is very simple. User A prepares (turns on the source) one of the two 
orthogonal states corresponding to or 1 which are sent with the maximum possible speed (the speed of 
light c; further on we assume c = 1) into the communication channel as they are being formed. As long 
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as the states are not fully accessible to user B, he cannot reliably determine the value of the secret bit. 
User A cannot influence (again because of the existence of the maximum propagation velocity) the part 
of the state which has already left his laboratory and propagates through the communication channel 
(the commitment stage). When the state becomes fully accessible to user B he can reliably determine 
the secret bit value (because of the orthogonality of the states) and compare it with that declared by user 
A through the classical channel at the disclosure stage. Restrictions imposed by the special relativity 
on quantum measurements allow to explicitly realize the original idea of the Bit Commitment protocol 
on providing only a part of information on the secret bit to the other party while spatial restriction of 
the state accessibility automatically results in the restriction of accessible part of the Hilbert state space 
even for "internal" degrees of freedom of the quantum system (e.g., spin or polarization) since they do 
not exist separately from the spatial degrees of freedom. 

The protocol employs a pair of single-photon states with orthogonal polarizations and the spatial 
amplitude of a special form corresponding to and 1: 

roo roo 

\ifo,i)= dkF(k)a + (k)\0) ® |eo,i> = / dkF(k)\k) ®\e ,i) = \f)®M, (1) 
Jo Jo 

where a + {k) is the creation operator for the state with momentum (energy) k > 0, J~{k) is the amplitude 
in ^-representation, |eo,i) is the polarization state, and 

roo 

/ dk\F{k)\ 2 = 1, [a(k),a + (k')]= 5(k- k'), (e i \e j ) = 5 ij , i,j = 0,1, k £ (O.oo). (2) 
Jo 

In the spatio-temporal r-representation the states are written as 

/oo roo gifcr 

drTir) |r) ® |eo,i), ^(r) = / dkT{k)e~ ikT , (k\r) = -==, r = t-x, r€ (-00,00), 
-00 Jo V 2tt 

(3) 

where .F(t) is the amplitude in r-representation reflecting the intuitive picture of a packet propagating 
in the positive direction of x-axis with the speed of light and having the spatio-temporal shape F(t). 
The normalization condition in the r-representation has the form [18] 

/'OO /"OO 1 * 1 P oo 

/ dTdT'Hr)r f {T')[-5{T-r')+ 1 -—- 7 ]= / \Hr)?dr, (4) 
-00 J — 00 ^ 7r r r J —00 

roo 



/oo 1 
r + a B K ' 



Important for the proposed protocol are the following two circumstances: 1) There exists a maximum 
state propagation speed; 2) Orthogonal states cannot be reliably distinguished when they are not fully 
accessible (even if they remain orthogonal when restricted to the domain accessible to measurements). 
The classical bit values of and 1 correspond to two orthogonal polarization states |eo) and |ei). Since 
the polarization does not exist separately from the spatial degrees of freedom J~{t), the reliable (with 
probability 1) distinguishability requires the access to the entire spatial domain where the amplitude T(t) 
is different from zero. To be more precise, any measurement in a finite domain r necessarily involves a 
non-zero error probability in the state distinguishability. Generally, any measurement is described by an 
identity resolution in H [19-22,25], and when only a finite domain A(r) (A(r) being the complement to 
the entire space r G (—00,00)) is accessible to measurement the identity resolution has the form 

1=1 dr\T){T\®I C 2= [ dr\T){T\ ®{V + V 1 )+ [_ dr|r)(r| ® I C 2, P ,i = |e ,i><e ,i|, (5) 
J-00 Ja(t) ja(t) 

where Vo,i are the projectors to the polarization states |eo,i). If the measurement outcome occurs in the 
accessible domain A(r), the probabilities of outcomes in the two orthogonal channels Vq and V\ are 

TV{p(0,l)(J(A(T))®P 0l i)}= / dr|^(r)| 2 = iV(A(r)), Tr{p(0, l)(/(A(r)) ® P lfl )} = 0, (6) 
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where p(0, 1) = |V , o,i)(V , o,i|> an d iV(A(r)) is the fraction of outcomes in the accessible domain. The 
probability of error in that case is zero because of the orthogonality of the channels p e (A(r)) = 0. 
However, if the outcome is not obtained in the domain accessible to the measurement, the error probability 
is p e (A(r)) = 1/2, and the fraction of these outcomes is 



Tr{p(0,l)(/(A(r))®7 c2 )}= [_ dr\F(r)\ 2 = N(A(t)). (7) 
v ' JA(t) 

The total error probability is 

P e =p e (A(T))7V(A(T))+ Pe (A(^ dr|^(r)|V0. (8) 

2 2 Ja(t) 

The protocol employs the states with a special spatio-temporal amplitude corresponding to a state con- 
sisting of two strongly localized and separated by an interval tq "halves" 

1 i-At rAr+To 

F(t) = -= [f(r)+f(r-T )i / dr\f(r)\ 2 = dr\f(r-T )\ 2 = 1-5, 5 « 1, At « r , (9) 

V2 J -At J-Ar+ro 

where (5 can be chosen arbitrarily small. The amplitude /(r) cannot possess a finite support [23], although 
it can be arbitrarily strongly localized and can have a decay rate arbitrarily close to the exponential one 
[23,24]. In the following we shall for brevity omit the parameter 5 bearing in mind that it can be safely 
made the smallest parameter in the problem. The latter means that if the accessible domain of the 
space-time r covers the interval — At < t < At + to, the error probability (8) is P e = 0. On the contrary, 
if only one half of the state is accessible, the error probability (8) is P e = 1/4. In other words, this means 
that reliable distinguishability of a pair of states (9) requires access to the spatio-temporal domain of size 
w To which, because of the existence of the limiting propagation speed, cannot be achieved faster than 

TO- 

The input states sent by user A into the quantum communication channel are pi n (0, 1) = (|eo,i) <8> 
\J~))i(J~\ (g) (eo,i|). Description of the quantum communication channel actually reduces to specifying the 
instrument (sometimes also called "superoperator") [19-22,25] mapping the input density matrices into 
the output ones (not necessarily normalized). Any quantum communication channel defines an affine 
mapping of the set of input density matrices into the set of output density matrices. Any mapping of 
that kind reduces to specifying the instrument T, 

/oo roo °° 
/ drdr' 'poutir, t')\t)(t'\ ®p{e , ei) = ^ Ai(|e i)0 ,i) <8> ® (ei,o,i|), 

-oo J —OO 

(10) 

where \ui) = /f^ drui(r)|r) are the eigenvectors of the output density matrix operator (kernel p ut(T, r')). 
Taking into account Eq. (4) one has 

/oo roo °° 

dr' poutir, T')ui(T r ) = AjUj(r), / d-ra^T^r) = ^A,<1. (11) 

-OO J —OO 

The output polarization vectors are |ei ? o,i) = o^,o,i|eo) + A,o,i|ei) (|aj,o,i| 2 + |A,o,i| 2 = !)• Any instrument 
can be presented in the form T[p] = J2i VipV^, with J2i ^ I [19-22] (it is sufficient here to restrict 

ourselves to the discrete outcome space i). In our case this representation can be written in the form 

oo 

T[. . .] = E Hh,o,i) ® K))«eo,i| ® <^|)[. • -](|^) <g |eo,i))««i| ® (e i)0 ,i|) + T ± [. . .], (12) 

i=i 

where Tj_[. . .] is the part of the instrument yielding identical zero on the subspace spanned by the vectors 
|^>®|eo,i). 
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Writing the instrument in the form of Eq. (10) we assumed that the decoherence of both basic 
polarization states occurs in the same way which is true if the medium does not possess gyrotropic 
properties. The latter condition is normally satisfied for optical fiber communication channels. However, 
if the decoherence of the states with different polarizations occur in different ways and depends on the 
spatial degrees of freedom, the following analysis can easily be extended to that case. 

Since the time of preserving the secret bit is determined by the state extent (tq) the channel length can 
be arbitrary; therefore, we shall set it equal to zero without loss of generality. Actually, the specification of 
the instrument is the description of the quantum communication channel just as in the classical case where 
the probability distributions on the output alphabet is specified for each symbol of the input alphabet. 
At the intuitive level this mapping can be understood (with some reservation) as the transformation of an 
input state | Vo,i) with the shape T{t) and polarization eo,i into one of the output states with the shape 
Ui{r) and polarization ejo,i occurring with the probability \. The fact that the sum of probabilities 
does not exceed unit, J2i^i — 1j can be interpreted in our case as the disappearance (absorption) of a 
photon in the channel. The channel properties are determined by the functions Ui(r) and probabilities 
Aj which are assumed to be known from the a priori considerations (and can be found from the channel 
calibration procedure). If it is possible to choose a new interval of the state halves localization at the 
output Dt such that 

Vi = l,oo, -/ dr\ Ul (T)\ 2 = --S, - dT\ Ui (r)\ 2 = - - 5, Dr«r 0l (13) 

where 5, just as previously (9), is arbitrarily small, the channel is suitable to the realization of the 
proposed protocol. In other words, the channel has the property that the strongly localized states at the 
input still remain strongly localized at the output to within Dt <C tq and Dt > At (fig.l), although they 
can change their shape and polarization. The quantity Dt then determines the accuracy with which user 
B can detect the delay of choice of secret bit by user A (delay of sending the state in the communication 
channel). The probability of detecting a state at the output by user B in the spatio-temporal window 
A(t) covering only one of the halves iXj(r) independently of the outcome in the channels "Po,i is 

OO -| OO -| -i 

Pr{A(r)} = Tr{T[p m (0, 1)] (J(A(r) If?)} = £ K dr^r)? < ( --S) £ A, < - - S < - (14) 

i=\ JA ( T ) 1 i=i 1 1 

and can be made arbitrarily close (with the exponential accuracy by suitably choosing Dt and tq) to 
1/2. In this case, the probability of correct identification of the state when only one half of the state is 
accessible (i.e. during time interval « To) does not exceed 1/2-1/2 = 1/4 (8). 

Now we shall calculate the probability of error for the case when the states become fully accessible 
(after the time Dt + tq « to elapses; for the ideal communication channel the distinguishability error is 
zero). If the state is fully accessible (after time ~ To since the protocol was started) the probability of an 
outcome in one of the channels Vo,i is 

oo 

Pr{A(r) + A(r)} = Tr{T[p m (0, 1)] (7(A(r) I c *)} = £ \< 1. (15) 

i=i 

The fact that Pr{A(r) + A(r)} < 1 means that not all states reach the channel output, i.e. the states 
are absorbed in the channel with the probability 1 — J2i=i (formally, this is the probability for a state 
to never become accessible for user B). In that case, where the measuring apparatus employed by user 
B did not fire at all, he can only guess which state was actually sent, the contribution to the error 
probability from these events being 1/2(1 — Y^i=i ^i)- us now calculate the contribution to the error 
probability from the events when the measuring apparatus employed by user B produced some outcome. 
The measurement minimizing the polarization distinguishability error for the two "honest" input states 
sent by A is given by the following identity resolution (for detail, see e.g. Ref.[26]): 

oo oo 

j^Pi® (E + E 1 )+V ± ^I C 2 =I®I C 2, Vi = \u i )(u i \, p ± = I-£Pi, (16) 
i=i i=\ 
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E + E 1 = I C 2, E = \e ){e \, I C 2 = |e )(e | + |ei)(ei|, (17) 
where |eo) are the eigenvectors of the operator 

r = 7oo|eo)(eo| +7oi|eo)(ei| +7io|ei)(e | + 7iil e i)( e i|, (18) 



Too = ^X^tK 1 ! 2 ~ Ko| 2 ), 7n = ^ A *(IA,i| 2 - \0i,o 
i=i i=i 



2a 



^ oo 

7oi = x i( a i,iP*,o ~ at,o/3*,i)' 710 = 7oV ( 19 ) 
z i=i 

Taking into account Eq. (18) and bearing in mind that the states and 1 are chosen by user A with 
equal a priori probabilities of 1/2, the total error for distinguishing between the polarizations of the two 
"honest" input states when they are fully accessible can be represented as 

-|00-« OO -i OO -|-« 

P^-tl-^H-TrlT^^ (20) 



i=i i=i 
where 72 is the negative eigenvalue of the operator T in Eq. (18), 

1 , ,1 



72 = 2 (7oo + 7n) - 2 V ^ 7o ° ~ 7ll ' )2 + 4 l7oi| 2 - (21) 

If the polarizations |eo) are |ei) disturbed in the channel in the same way, one has 72 = — |toi|- For the 
ideal channel Eqs. (18-20) yield P e = 0. 

The protocol consist of the following steps. 1) The users control only their local neighbourhoods. 
They agree in advance on the time when the protocol is started, the states {J-(r)) employed, and the 
adopted polarization basis |eo,i)) for and 1. 2) User A encodes the secret bit b (0 or 1) as the parity 
bit of N states and 1 consisting of the blocks each containing k bits (b = Y^jLi ® a [hj], « = an 
a[i,j] belonging to the same block are identical) and sends k ■ N states randomly distributed among k ■ N 
quantum communication channels. User B performs measurements described by Eq. (16). 3) At the 
disclosure stage, at any time — At < t < At + to, user B can ask user A to announce through a classical 
communication channel what he actually sent to user B. 4) After the protocol duration time elapses, 
user B compares the outcomes of his measurements with the data obtained from user A through the 
classical communication channel. 5) If all the tests are successful, the protocol is completed; otherwise it 
is aborted. 

Before the protocol duration time elapses completely, the probability of correct secret bit identification 
by user B exceeds 1/2 (i.e. the probability of simple guessing) by only an exponentially small amount. 
Indeed, if the block representation of and 1 is adopted, the number of binary strings of length k ■ N is 
(sec Ref. [27] for the details of summation) 

1 N 9 N ' k k Itt 1 

Nodd = N even = - £ CW k k = £ cV™ (— ) cos (INn) « -2 N ' k , (22) 

m=0 1=1 

which practically coincides with the total number of binary strings of length N-k. The Shannonn 
information [28-30] of the set of block strings is (to within the rounding) the number of binary digits 
required to identify the string parity, 

foN-k k j \ 

I = lo ^[-wJ2 cosN ' k (j) cos ( l iV7r )J ^ N - k > t?- 1 ' ( 23 ) 

i.e. one should know almost all bits in the string. However, if only one half of the state is accessible 
(At < t < At + tq), the error probability for determination of any particular bit in the string is not 
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less than 1/4 even in a noiseless channel (see Eq. (8)). Therefore, the probability for user B to learn the 
parity bit before the protocol duration time completely elapses does not exceed 

P{parity) = i + 2~2 N ' k . (24) 

We shall now calculate the probability of correct identification of the parity bit after the protocol duration 
time fully elapsed. The block representation with k bits is stable (the errors are corrected by majority 
voting), if the number of errors in each block does not exceed k/2 — 1. The probability of wrong 
identification of a block-wise or 1 is 

k 



p e {k) = y: ciPi(i - p e ) k -* « v^ [2 v p e(i - p e )\\ (25) 

i=k/2 

which can be made arbitrarily small by appropriate choice of k. The total error in the parity bit identi- 
fication is (we assume TV to be even) 

N-l 

P e (parity) = ]T C n N P l e (k)(l - P e (k)) N ~\ (26) 

i=odd 

where summation is performed over the odd subscripts i only since the error in the calculated parity bit 
arises when an odd number of blocks are wrongly identified. Making use of 

L [(x + y) N _ {x _ y) N } = £ C^y N ~\ (27) 

i=odd 

and substituting x = P e (k) and y = 1 — P e (k) (x + y = 1), one obtains 

P e (parity) = |[1 - (1 - 2P e {k)) N \. (28) 

By appropriate choice of k, for a specified quantum communication channel the probability P e (k) can be 
made arbitrarily small such that the quantity NP e (k) <C 1 is exponentially small. Under these conditions 
the probability of wrong parity bit identification after the protocol duration time elapses is also arbitrarily 
small so that the probability of correct is arbitrarily close to 1. 

Let us now discuss the protocol stability against cheating by user A. Since the minimal Hemming 
distance between the two block-wise strings with different parities is k (minimal number of non-coinciding 
bits), alteration of the string parity requires modification of at least k bits. Since the probability of correct 
identification of each block-wise or 1 is not worse than 1— P e (k) — ► 1 (see Eq. (25), P e (k) is exponentially 
small) , the probability of undetectable cheating by user A does not exceed this quantity. 

The protocol is also stable against the delay of choice of secret bit by user A. Note that for the 
"honest" non-delayed input states the probability of the outcome in the channel _L, V± = I — J2iZ\ V% is 
zero: 

Pr(A(r) + A(r)) = Tr {(T[p in (0, 1)] + T ± [p in (0, 1)})(V± ® I c *)} = (29) 
Tr | ^I>*Ko,i| 2 ^) ® |eo)(eo| + ^^,0,1/3*0,1^ ® l e o)(eil + 

^E A ^o,i<o,i^ ®|ei)<eo|+ ^AilA.o.il 2 ^ ® |ei)(ei|^ (I - Y^Vj) ® J c2 | = 0, 

since |aj i0 ,i| 2 + |A,o,i| 2 = 1 and V{Pj = S^Vi- 

Any delay of the input state for more than Dr can be detected with the probability arbitrarily close 
for 1. To prove this statement, we shall need the requirements imposed on the instrument (12) by the 
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special relativity (to be more precise, by the existence of the maximum propagation speed). If a strongly 
localized state (in the sense that its amplitude /j,(t) satisfies the equation J^ T (1t\^{t)\ 2 = 1 — 8, 5 being 
exponentially small, and At — > 0) is prepared at the input of an arbitrary quantum communication 
channel, then this state cannot be detected at the output of the channel in time less than t = L/c (to 
be more precise, the detection will take place within the time interval — At + L/c < t < At + L/c with 
probability arbitrarily close to 1, where L is the channel length). In our case the instrument (12) should 
map the states prepared at the channel input at later times into the states that arise at the output also 
at later times. The delay of the state amplitude leading front at the output cannot be less than its delay 
at the input. 

Any delayed input state can be written as (we omit the polarization degrees of freedom for brevity) 

/oo 
cIthi(t)\t), (30) 
i i 

where \m) are the density matrix eigenvectors and the supports of functions piir) do not overlap in the 
interval Dt with the support of the leading halves of the functions Uj(r) arising at the channel output 
from the non-delayed states. At the channel output pdelay will be transformed into the density matrix 
whose eigenstates \rjk) have the supports which also do not overlap with the front half of Uj(r) in the 
interval Dt: 

/oo 
dr77fc(r)|r). (31) 

This implies that \(r]k\ui}\ 2 < 1/2 since %(r) does not cover the front half of Uj(r) where half of the norm 
(i.e., 1/2) of the state Uj(r) is localized. 

For the delayed states the probability of the outcome in the channel J2iPi < I is 

Tr|^%l%)(%l) (E^i)} <!> ( 32 ) 

while for the non-delayed states this probability is 1. Similarly, the probability of the outcome in the 
channel V± = I — J2i^i Pi (note that for "honest" states this probability is zero) is 



Tr £%| % )<%| U-£^ =P±f^0. (33) 




The sum of probabilities for both channels is 1 if all states reach the channel output (are not absorbed, 
i-e- Efe% = 1). 

Possible delay in the choice of the secret bit (delay of the state) is detected through the appearance 
of outcomes in the channel T > ± with the probability p±. To change the parity bit, it is sufficient to delay 
the states in only one block containing k bits. The probability for user A to delay k states and remain 
undetected is equal to the probability of an event when all k delayed states do not give a single outcome 
in the channel V± thus imitating the measurements statistics for "honest" states. We have 

Pcheat = (1 " P±) k « 1, (34) 

which can be achieved for any specified pj_ by choosing a sufficiently large k. 

Thus, the protocol allows to realize the honest bit commitment protocol with the probability arbi- 
trarily close to 1. 

This work was supported by the Russian Fund for Basic Research (grant N 99-02-18127), the project 
"Physical foundations of quantum computer" and the program "Advanced technologies and devices of 
micro- and nanoelectronics" (project N 02. 04. 5. 2. 40. T. 50). 
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